Binance said Saturday it has covered 90% of the $6.3 billion in token assets stolen from its hot wallets in the record crypto theft announced Thursday. The FBI determined North Korea was responsible for the theft.
The exchange will continue purchasing remaining token assets through market and over-the-counter channels to reach 100% coverage. Binance stated that "all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%" and that "Binance will absorb the financial impact of these stolen funds, not our users."
The outstanding 10% consists of tokens outside the top 10 that are "less liquid, which means they may take longer to source in the required amounts." Binance is using its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish assets.
Binance plans to resume withdrawal services by Sunday, subject to security checks, while continuing its investigation. Co-CEO Richard Teng said the attack involved a more complex process rather than misuse of a single engineer's permissions, contradicting an earlier statement about a compromised DevOps engineer's laptop.
The FBI said malicious North Korean actors laundered the stolen assets by converting them into Ethereum. TRM Labs, a blockchain intelligence company, noted that features of the attack matched earlier North Korean-linked heists, including small Tornado Cash withdrawals funding an operator wallet and signatures obtained in advance then executed in one burst.